Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
- Size 3.6MB
- Sample260511-cp3aqaas6s
- SHA256 c5fe3cf2a2d63a9104c6504c9f2f7501dbea4de1197090399426ce829563b38c
- MD5 ab3b925547d164a7eb593732d5f74be9
- SHA1 16e08ecbb48f0a4faf7b1b1c4e2b27a1800f69ba
- SHA512 e4254f4c9d3ed146f0c7dfcaffa54e1851988c2af42c8b9122d79cfa6abc322bb09f566c62f2e7d597b1567aeba9f5d7916a489e3fe375e6ad5972d1990cd522
- SSDEEP 98304:LnCG4h7FiRA7WkAbJ5rCmIZDjNJp42+CCSz:Do7RWkwgmIZDjNJ+PS
- TLSH T18806BF21BDB14427C46303328D6EF67D316DBD742B3491C763CB3A5C29386E15A3A6AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4544 alg.exe 3896 DiagnosticsHub.StandardCollector.Service.exe 4260 fxssvc.exe 4264 elevation_service.exe 3932 elevation_service.exe 1344 maintenanceservice.exe 2664 msdtc.exe 4076 OSE.EXE 4552 PerceptionSimulationService.exe 3804 perfhost.exe 3684 locator.exe 948 SensorDataService.exe 1548 snmptrap.exe 2980 spectrum.exe 2240 ssh-agent.exe 3960 TieringEngineService.exe 3044 AgentService.exe 1108 vds.exe 2748 vssvc.exe 1036 wbengine.exe 2556 WmiApSrv.exe 2456 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe - Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin spectrum.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6373c73714bf40d2.bin alg.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3196329ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026ec5028ece0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048ea6f28ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042acb228ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042acb228ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e109628ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c5be228ece0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 684 Process not Found 684 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeAuditPrivilege 4260 fxssvc.exe Token: SeRestorePrivilege 3960 TieringEngineService.exe Token: SeManageVolumePrivilege 3960 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3044 AgentService.exe Token: SeBackupPrivilege 2748 vssvc.exe Token: SeRestorePrivilege 2748 vssvc.exe Token: SeAuditPrivilege 2748 vssvc.exe Token: SeBackupPrivilege 1036 wbengine.exe Token: SeRestorePrivilege 1036 wbengine.exe Token: SeSecurityPrivilege 1036 wbengine.exe Token: 33 2456 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeDebugPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeDebugPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeDebugPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeDebugPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeDebugPrivilege 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe Token: SeDebugPrivilege 4544 alg.exe Token: SeDebugPrivilege 4544 alg.exe Token: SeDebugPrivilege 4544 alg.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe 3652 2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2456 wrote to memory of 1148 2456 SearchIndexer.exe 105 PID 2456 wrote to memory of 1292 2456 SearchIndexer.exe 106 PID 2456 wrote to memory of 3976 2456 SearchIndexer.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ab3b925547d164a7eb593732d5f74be9_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3652
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3896
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3548
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4264
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3932
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1344
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2664
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4076
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4552
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3804
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3684
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:948
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1548
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2980
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4524
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1108
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2556
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1148
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2824 2768 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:1292
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2760 2664 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:3976
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 3225d2d359036a5a0f0de2833a44092e49add56cce8124ffbf71529234cc9033
- MD5 3f1c2c2eee50e04dfdaa284c091da34b
- SHA1 f154d08ffea3f40f98ae6af442501d7283dd8084
- SHA512 7aef12ae10020cceced882d87423798e0e3e1360bb93ae4d6459932d2a80bca97977ba5392a72defb2fb34c24ba9198632221d8021fbe24973d7ba61ce2f0a07
- SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/dc3L6CuQQSz:Y3q6sjBg2+CCSz
- TLSH T13FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 cb3be58d04220749214016f1e0d21e6a999d7455ad9dbcfbf7cda271cead3d86
- MD5 4e5b5bac941cd0c266230fff3760409d
- SHA1 8071ff1ad16f6b91a83f6593fec8eeaa966a7987
- SHA512 40e26907b4fe3b65585b9efb995520ed67a9d4b838d77221dbf6c15ea4f0fe1737cb4a284ae831cecd636c45d66fba0e4fd6d6ded84c1470e76447769e8ba2d0
- SSDEEP 12288:X1XLsswWkxy2lRq2czADop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjptg:FXYfDtczA0NDGDn7q6dZhsCuarQSj/
- TLSH T16165F12877D408F9ED67823CC9A1C411E632B8954364F79B03E4DA661F336D85E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 2bcdd52f139e2852d1c963b5bea9e74b03377c44cebe91da5519cb2f27cfad62
- MD5 b2f8b9ccb3b113f6132f07c9bbae486a
- SHA1 8dbad1396b370f4be0e468d89d522cac4db837bd
- SHA512 247c29afc9136547a485a2281b8deb6d83874cfa9c1de80598520a48ab91f66fac96e1d647516ec603ba6db76ed3e0d894cba6f41e88b9c865ef2a69df94d90f
- SSDEEP 24576:n0Le5ji0hmxxrM3NDGDn7q6dZhsCuarQSj/:nPji0Ajydc3L6CuQQSz
- TLSH T1CC85AE16F6748375D073C0B9C5D2A68EE971308657308ACB4286D77C3F67AE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ae793a8aa262feb18b8ae2b38575bc399bd8d361eb0a4066019ad16a29d54b6b
- MD5 bee7085d8d4d0e508cd159152e81caef
- SHA1 f2b9f4d75678579d297fe481668c6e9fd84a9727
- SHA512 a6f1baef7d09da50257c6fda1491ff945d67d6b8caa679403d9bf3be998b88ee11fd5129ebc3b9c031fad8d7c5d537506e81127191badac402f5c5744794fcc6
- SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyu5NDGDn7q6dZhsCuarQSj/:c/ezSC6vUzPveHjyGdc3L6CuQQSz
- TLSH T17E756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9b0397b84f020b03af20f5d0326a878ce4a644570df2468ce4b432baa1617fab
- MD5 1f5347c6f18797b451bbaadef8048ecd
- SHA1 447b7cf1ccbc6d2b6e442ea56f6446696073deb8
- SHA512 b97dd2a0a007067974e90a4e1cfbbb17f72f56ff0cabfa10310652a57a349227cd628ca092fa056f7680f9d90beb77c4b6678f3b5d0a021f20819a6211fe01ee
- SSDEEP 24576:dVbqPb88hv/l+YQNDGDn7q6dZhsCuarQSj/:dVO88hXl+Bdc3L6CuQQSz
- TLSH T1D6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 24a15893af9ae53b7d0af1c8186ad02dec45519485b19b012b5c0775dceae629
- MD5 96865819e7469e64212de5024cb73ff0
- SHA1 61dac6b63c6f8f21a83689fe539960603355d64c
- SHA512 855544f8a2676fdd785b2a4512e8d73f75f651d5d858a425d5925892f5067e5ceb43f8d83feba2482ebcc20468967f0d842fb72c23e902adaadbc85c892e0859
- SSDEEP 12288:0Liop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/T:0LjNDGDn7q6dZhsCuarQSj/
- TLSH T152452349894460C6FE7BCE382614CC1196306DE9B4697B2541D2FFD61E384F0EED1AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 e039bbaaa3ef67110a2ae0ef6f6c3983558df91d54bcc45dae2041440b10e3e5
- MD5 0f5eb41b27dbf1baf9c3f8ae90c0695f
- SHA1 93681a704faf5e90047b2f3177ac0bf894829189
- SHA512 2099e8074ca09d33794b071e7248bff940880baa4d9abc569a9e61c896f57b8ddbfa81e293e3be4044f22fa268ec99591978fd701072ae1bf7270814472caad4
- SSDEEP 12288:neBNUbTVO86UHop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/K:nJIUINDGDn7q6dZhsCuarQSj/
- TLSH T10765CF2BEE28FCD2C67A8DB85B51C600D77278704B62A3CBD165C34E9E235E05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 072659ca424973f05c6024ec725162abefd1b22b0a36e085eb842a021024407c
- MD5 08d19e07685121833386b3c14f41d945
- SHA1 6583f0f666885f686e607f7f075ac7d4d1ae3dad
- SHA512 c28de2b58e2a165e42b159d193b2da966edddcb3c2ab076d53435787203d9359a2994da80c7c1f0aaf90465563368c17f83e5bd38b41ef5d30068067b02ed8c4
- SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:XQvGAdlCEL8c/DRNw5Cp2+CCSz
- TLSH T18A266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 5504080ff832ad00936fc2eec7d1458de8ec1416bb74c7ee16f1bb273dbbf011
- MD5 53fca7a3241c2a7fd1ff36118708f11f
- SHA1 87bd435d792cfc3e11826ed77c1588144471426a
- SHA512 c366a1d04f2ba1e2be134fc56362ce74abbce47c71d6cb06f641eba33930221622a821fe2621fbc444885e86def2cfdf045b5eab2345c8418725defc57c2c15d
- SSDEEP 12288:LAwSfxL/2Dc3RDLLmt0LDQewsAjJop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwroi:00ewsAjiNDGDn7q6dZhsCuarQSj/
- TLSH T1D475E031FE74E036C6BB0DB61B25C716543CB9604B612AC3E3E89E9E59301D12776E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2a5a70832879c9cfa8442d3c1e07f263a4c1a39d661c913360d12b58b61c2c96
- MD5 b616f3efc69e44c2f04d1922c2683387
- SHA1 f3dc23a3a39991d8cd20fa122c7f581c26332a32
- SHA512 4eb4d265c9c99e6235d9d4e0d886fffab5ba4384928ad3551a62ab69076e4001bd4403d8494f8d18c1a850240b0d4a938f017f8501dcfbf54a5cd29a58a76816
- SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6PS:mUEtQevvqc2W1cpV2tI32QS
- TLSH T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 7b941bf49c394e6d0a2443e4e508286ca9e866e11caa15a2b92d909894bc84ce
- MD5 ac7fc97555358847f8c9c7a222d8b66b
- SHA1 2225467c0fb1b3238c8ccc8167c88970dc91d216
- SHA512 6578396509734145e2ba24ce6a307a55c167e29179ae58bb9c077fc814c7f3df6af35d805945df65fc020d8c0f73a772fc61b30f5d6013bc0919326e04b68a1a
- SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zCdc3L6CuQQSz:2oquVjnmd2+CCSz
- TLSH T15ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c180fe529c5470bb800f0596eb1e06847fae0000c98e0c48fbe817a35354e5b1
- MD5 2c3a67cc4882516b4eb0ef9c277ccf5a
- SHA1 a130da6049953fef9048b8c7998ab274e3bab7a4
- SHA512 b68e7a950b25b1edf0a74e4afc904e0200587b27ac071a340c81a9a7d8e4ddb8144bf8446e44bf8af5a39df1443094fb55515a96161058835748c866f7f866c3
- SSDEEP 24576:fAhGL3IFoiwtA5l7S539NDGDn7q6dZhsCuarQSj/:fAMUFoiq5Ndc3L6CuQQSz
- TLSH T14A35AE80E7F955D4F5B3AA7899768470EA76BCAA5E31D20F2150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 6988f3147f0f74e6e05a49f7614414b93e3120f12b32f589cc585d09d81cbd2b
- MD5 dace220a7c1be55f36ff948fb6f3754a
- SHA1 511165b8201c86b9886ddeb972a5f682e5bd8393
- SHA512 e0bdc09a962a8114a94d0e68d597336997857ce1cec3d406ced871392f0c678a1996cc24c7ef6b4e7d70f952c338f4ae73d8a48e8558aed9b6e1d5b020937335
- SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+CAop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWx:fwu4OWmNDGDn7q6dZhsCuarQSj/
- TLSH T16865F14976A41CF9E97786388657C432F7B2BC123625DB1F03A0C75B5F37260AE29B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 03200326b7b2fb7022416e3a27adb01a3682d680fe6f70ce9eb232ba4c1d2e7a
- MD5 528bf379e0764e948269677ee4e1c430
- SHA1 8182224fcd9f2640bd333146b2e3f0abf477173e
- SHA512 e5f275094e46224d39d68d19252c33b5a4e3364ee2d21940e7504ae5c50582ee8199335f6bb301be3aa3c2bf0e8aee4a70ec98a266e3d6616a6ee77981a27082
- SSDEEP 12288:9eZ1Iy5op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/P:4ZuvNDGDn7q6dZhsCuarQSj/
- TLSH T16C55124A26D430F9F9B7CA3C99A08905D37078A6733553CF02A197A62F319E09E75B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e7c35b6ef740f60ee06ad085335d30b31eade9eb681e80ae108d8234e52ab04d
- MD5 2f8ff7a51bfbdf16d07236596d12ed27
- SHA1 6da61c0b9dafd821219d3b6e94cd37708b2de004
- SHA512 2cb31f8f4369bc02cb428c505d154e17b7768707ceac487cc9970bad0f10d46da87ccacb9c0a7a19ce6d09e4d9373e9e6e6d2be59b5222654b511232002bf396
- SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:JQRQyi36YOcPbLvw2gAf+PN3s2+CCSz
- TLSH T110667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 02c15a269eeb88326c6ff6a7420f43752d571ded98be7085e91ac469de385b8f
- MD5 c5c83a18873c393dc899563035ca09e9
- SHA1 b09ac9a68c305102b3f52c0cd7391e244954f1de
- SHA512 6639da750527a947ff584223f838126a7e87fccf3447b85fcf9bfbb88f773316e6f0107b935ceee4c0a80fe5b861495b4a2cbc12401011873c73866b957b0bc6
- SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:+QRQyi36YOcPbLvw2gAf+PN3s2+CCSz
- TLSH T155667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 5bf451c7c1e543b85d66bbef2f8ec577541e579d0167a1c4fc4f1a23b98e694c
- MD5 056fbae4fc4c55763180e7baa2067c37
- SHA1 13d6b2409dd7a6c6781186d7ea4bdd0e66edacb2
- SHA512 9b3e66167315cd3e102ac97641b0440bf30ce9192fe7eea7d8da081654fe1f73b9e8d5e421127029f830a51b771aaa2f6f781b21239b6261999a1418ebb03891
- SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0/NDGDn7q6dZhsC3:068Qg55nhceWu7PNU3/ydc3L6CuQQSz
- TLSH T110B54933B2F600A9D44DE1769F4A872196E17C758FE0E3DB815172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3109c0e66d56af6bb748a9b2724e12695c886d132b88a3fcdb806d09a482097d
- MD5 8f64dbeb80b0ce5e64883d860e644ffb
- SHA1 1ac84d84a5235319953f08f437ec44d0e0624c9c
- SHA512 26e85324185da30fef322bcef191acac5c885c310a7a3daadba590fa852c8f5e3fcd9b4945aaf2d70a93a2f5326921b0356bfb8b1826dc2a4a71d43c97bd7219
- SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk995:Hy5112gYy5azzVvt69nLKnhZj2+CCSz
- TLSH T1B4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 16a525a8aa69f57936a53e4785b5c2c05794fe65680f2418ec5674e959277ee2
- MD5 823b27db05b61e3cd3bcaf591af9076d
- SHA1 444b2132d13fc8735e286e7003aa6d7ecb83c987
- SHA512 e3125cbafe0015eb94cd231af1a2da09ea5d1f64004831d330bbccfb2e220cde5361e76a11c704ba7165525287fd6d59375d8c06cff1fe3f35b4236f3d37c918
- SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEdc3L6CuQQSz:3u6Jmdxd2dE2+CCSz
- TLSH T122D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 84be885be336b0dc2ad8d9a609f9f7936bd1df3820967fa2c277cc46765631c3
- MD5 57879494d5c34cc5f28cb02d38755ba2
- SHA1 d654c9a4b5bdecc3947adcebdf9e50a299a7ccad
- SHA512 5a8227fd0c46e84d52052e6197c475bf032f3a531d82e9148d1995f4e6f7d4b6c90a614d80bf04612f6c768aca5b1b76d2bebd25a2165bc5cae0f9b7393ec4fc
- SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xodc3L6CuQQSz:0mifPWRd2+CCSz
- TLSH T1F4B5BE13F2D800E8D06ED17887569632EA61BC460B34B6DF0A90B7961F7BAE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7b73d365e6c20f240ee3f296ce591b861f79ff703258f6642f4bbcc6c1b4bb8f
- MD5 9300a085fa233775c00f7d19fc466766
- SHA1 922b769f4d55111a33d4de330483ca99cca1f163
- SHA512 7bdbc9f5a98f47be885e399c91e73f83a48de01e33e4956973f4c634886a0e29bd8e68928305d44355c2d605aef0d38ad281052d98ff54c9239b4b1544686b25
- SSDEEP 49152:CSuZQIY0Be2KcRVtOnks6NMHqvdc3L6CuQQSz:c5dKii61v2+CCSz
- TLSH T1D8C5BE03F2E940E8E0BED67887659632EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 82df1bbafb3c2b4af6ce81b52bbf1b119a0aebe31b7bdd6c5cd1f4ba4c1a7635
- MD5 5bd13cc8a4c72df5e3c4a7bfeff5e48f
- SHA1 ef695fde735ec175af581f92ea8b133475eb15c1
- SHA512 6024a37133f2154b623d0b25f4267f1372486d068835aa737715c10e441a84124124fc6103499a189cd730c286ee3edc4c5e09b77fdceb121890293346e45508
- SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w0dc3L6CuQQSz:hX2imphx2+CCSz
- TLSH T1DC95BE13F2D900E8D06ED178C7468632E962BC160B35B6EF0A90B7561E7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 9d72172bd93f69b291a2db92eea90a74d3df975e8e0b583aab8addb300204bc4
- MD5 7ec03c5ff17b622072be2c0ae1c78868
- SHA1 7359e4c6eb9b5b186a1defa7c9016b505b8f19b8
- SHA512 5f25e91dd7aaab0e7a8cc4e827ac8f33bf10c703f54229a07eecd6095ee6fc92e9ae2a332a26ce1a83af8fcb1a1e384860457f43a025af0b8b11f9905503d952
- SSDEEP 12288:p6op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/z:p7NDGDn7q6dZhsCuarQSj/
- TLSH T133452309984450CAFD36CE795A14C81195206DEFF069772592D2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 e880ebfbcc25d874f5e90f572428f3d6877f192ebd56f061f7bda9df986d6c0d
- MD5 7d50bb542e59130c7d3d22683d8e85fb
- SHA1 d80c9980997d2a1271e6872b540fe12a4d653453
- SHA512 2ddbaec91e6541512363487b7f4a6979debbe9f0ad7a19189eb95104cbfbed1504a5ba5f53cea887b67f9089932630192cc6ff8866e040bb79c9dcab4cc91fe6
- SSDEEP 12288:W1op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/X:WuNDGDn7q6dZhsCuarQSj/
- TLSH T1FE452309984450CAFD36CE795614C81195206DEFF069772692D2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 3490a66af3510f9d34e32a0892818fb8d78e4effa7a96709cde1bd8cc579f254
- MD5 7c5cde65cb85d66d6ee2731801d5ed4e
- SHA1 7f60dbf77a01a8afa4b11a5577bef12228dc1758
- SHA512 dfaba2e4befe6ec9d7aeb0c759f2eb9aac632112d4252c8cbbb6bf37e4f8234620e537638c78762adb1fc98f8034727bedf8dc7a19d12fead5114d434b4abf44
- SSDEEP 12288:T/op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/X:TgNDGDn7q6dZhsCuarQSj/
- TLSH T10E452309984450CAFD76CE795614C81195206DEFF069772692C2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 8dbbbad25b4fa979fa87da8346a159d32139d0d44f356db6ba0cb4b6b21f64dd
- MD5 07891bc619cf383f293dc7e36928dcaf
- SHA1 7828a01648611a553f11b1fc30fa3723329b8217
- SHA512 f09e71e54c791695f039c888b04a68ef48c823d8b0270277822fe8a6a23f87e902b879f29bfa1319bdb0940969c18d9d7f252fa7356ff24056b6fd664bee3f5c
- SSDEEP 12288:JVkop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/7:RNDGDn7q6dZhsCuarQSj/
- TLSH T17E4523095A5850C6FC77CA789A10C411E2707CEAF135776F9281AB961F305E0AEB1FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 900c718a103f5b5a152f067b662f4c57d136988d03c519e820b56dbb3cc7a9c9
- MD5 fd0f75d050c66c21c7960398cf9ff07e
- SHA1 340c788e95f1ae1d8d59c4234e520c12d616541c
- SHA512 4525d9a214f8229bfef738431de5f0510705b91d652f1069c7c3053a44d7b07b931bedeb2efb67c8ba0fc81ee29a68959bec1f6b57e7d10fc630c22fd9f9d50c
- SSDEEP 12288:FMop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/Q:FlNDGDn7q6dZhsCuarQSj/
- TLSH T13D452309984450CAFD76CE795614C81195206DEFF069772692C2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 8740a406e094661bc3651ea7009bcbfa7e1536f59fced250ab42f8d69db98853
- MD5 2004ab4c2cdb63eb571b8de67cfb0810
- SHA1 0383132d0f89cf809ba765cb6fdfe6a68c18cb56
- SHA512 fbdd4985bbf8a49aa15d4de5dd8233d5b179f0c13907ee23a093faff24186705c97440ee26963b4ef6579d8a02b372717b8bdf9df9416199b151d9b7dae25bc2
- SSDEEP 12288:ZBop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/k:Z6NDGDn7q6dZhsCuarQSj/
- TLSH T178452309984450CAFD36CE795A14C81195206DEFF069772652D2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 f6d41af5c7ea66862d700ee3e6a69fd36e3589f10f0fb7e34b1787c1f15fecbf
- MD5 6390ad4d2c6df8fc7080bb7384778a97
- SHA1 1f405213d8c5f4b3f1d1829052003a44e8324957
- SHA512 c91f0f4c00e8bbfb247f34c760db7ccd608a5807a5853a0b486104d5077b8e1a1112dd3e74e3573e8e771c720b5fd01ef93f17c12d31e935f327ba8a0fec7931
- SSDEEP 12288:Q9op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/M:Q2NDGDn7q6dZhsCuarQSj/
- TLSH T18A452309984450CAFD36CE795A14C81195206DEFF069772692D2EBA22F344F0AED1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 46e785d182803b75210b25f07d9fdf4da7d394a313add415f032c8f618202b57
- MD5 cab22782b0e207395a82a87f324534e4
- SHA1 db0084fb93c287bb937decfb4e1b35683ccc4edb
- SHA512 c154a9e5ac608b6976089193d4b0b9c44a21365daf8412857c6427269c12430c447233b23d24285e51d0ab02dbb9334b73f82b142a50528630725cb3d77f3573
- SSDEEP 12288:miZwbVzzFEoS2cPvyVop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/j:pZMRzFVSOONDGDn7q6dZhsCuarQSj/
- TLSH T10F65F199B39018F8EC67863E89158806D6B17C6A5670C71F03E437675F332A05D3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 88c69d5933a568fb84206471c58db3787d5b1103451c2b610b6ac3a76f6f93cd
- MD5 c42aabb9436b08b1da755e63a7e9eccb
- SHA1 3020dae4f9b375ea5e669b2b07c91a91d858edd3
- SHA512 0dda17d7be3150d889eed9f270f03d3c9d41b8c662de48fb2a768c98133550df8303c6a1a158b41d63b0083360cd6fa496f713a307839aba3868d6778d1454a1
- SSDEEP 12288:I+op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/9:IfNDGDn7q6dZhsCuarQSj/
- TLSH T1A5452309984450CAFD76CE795604C81195206DEFF069772692C6FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 77877073e2c7d58d58dba0954d24033c32f9c98557a0ee261390c69edb49400b
- MD5 d5e3f3359a91591a01f1f140a8b02f66
- SHA1 d29ea77c21165b17a0eff0ff6217790185f4c4ad
- SHA512 8d94ebf6bd0d6e4cf502974e078b5e73ee70dd355946467827ef6b55a6421d57220da319bdfc395349ce739ddf521519bff4b5e29e29b997a10779eb8211d8d1
- SSDEEP 12288:TSop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/j:TTNDGDn7q6dZhsCuarQSj/
- TLSH T15F452309984450CAFD36CE795614C81195206DEFF069772692D2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 03bf37e1e2aff28c32b5c78cc4add2db85401df678a81e7442c2299f0314d016
- MD5 4143b371b394b7a4e105465ca7c0269b
- SHA1 09a67ab3224f8d5fd246999a362beb8173ca9c83
- SHA512 ad1031811921756684a54e15a4ff668b53b81288e41e61ac4d12a537d78d0c3a52e222b3a6bad9a40a6cc459cbc970d35f71775ea184a236b59f0fa5c2accff4
- SSDEEP 12288:LyPz5L85op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/S:mzySNDGDn7q6dZhsCuarQSj/
- TLSH T15E55120776A030F9E537C63889514902F371B87657249BAF13A047B72F366E09E7ABB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 06ae41a264fb1268db64ebad444c2eeeeef85a35a62e509841b05965012c1302
- MD5 6788e301d304276d1255eee303c90aaf
- SHA1 1aea685691eaf209a88b9ef4c8df9e44f39b323a
- SHA512 4ede9275165d2dcfeeb2921e4e48ed6e39a93cd5e1cc5faf7ffc2cf6582229f6be42c5f8e260a94db11c7377394c5d223495c605a74046232b49ae2ca2a02659
- SSDEEP 12288:R+op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/M:RfNDGDn7q6dZhsCuarQSj/
- TLSH T160452309984450CAFD76CE795604C81195246DEFF069772692C2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 d0b6659ed06ca209d0f96b2cf859942a9fb013c447722b7c2e6761c19e152a70
- MD5 301d75264fda3097964bb6a699446b37
- SHA1 2ff939050e88a98bcbaa32299bab53c4fc8d6640
- SHA512 baadf5fe7756051b559a2de2601c9d1bca36a2a1085ff9ddc11fb25166d8e7ed1868d627baf927beed91223746f4158559cfd7dde9cf81babeefb1ec2b727c12
- SSDEEP 12288:N+op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/z:NfNDGDn7q6dZhsCuarQSj/
- TLSH T10E452309984450CAFD36CE791604C81195246DEFF069772692C2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 f04e8d64277989650a78a9113c50b4ce433ca78f4cdd1164c3656ae5f900d925
- MD5 7df49879d5553c4cf2162ed6c2409984
- SHA1 a0aeee1eab5848198fa7e82dfc728513875b5755
- SHA512 bb023b5074df35b4aa3287ba6ab59a7cb7972140fee613fc8d9d79aff61b2ec710ab37ba96133c709e8ed6a47950cc648dc4c99f4b0a5efe19452aa40d3281f8
- SSDEEP 24576:1CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA8NDGDn7q6dZhsCuarQSj/:1CUZPTY+8Wg2lIL8lrIUJLWwldc3L6C3
- TLSH T18265AE1EA3DC0896D4BBC1358A518A06EB32782E1B22D6CF1160C77D2F27EE55E75F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 bedefecd3d1137cdf13727e296b4e85ad41893ff61d55480bf8c63e3ad309b8a
- MD5 b8b025e9b5105efbf156f0e5021c4683
- SHA1 6c3acaf1147bd84eb06c9bb70c2acc4bc2d4a8ff
- SHA512 86189743b353bd92ab88cb50f5f07c670ec0dcd8cc4f20cab31ba1ca695e95f08a4c0c89a7e129c5b44dcedd9683c5c354059ef2f8d46ce574d2f262ea4ec208
- SSDEEP 12288:nbsfOop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/z:6vNDGDn7q6dZhsCuarQSj/
- TLSH T13955F009D29801D8D46E9679CB158901B3337C6A93E1E3CB52C0FA7E1F355E09EEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 2eb291efaa9dec6fb3e819023062407d674867c4305e26c4a9f355f0904920ed
- MD5 bf006937ac36a0c944c202bcf66e8918
- SHA1 25ee0bf8f43afeecda97ddbbd070cb09637c1e6b
- SHA512 aeca28dd32b7b2d12e2da6dfda97df530a944784306b47cd46849ae3614f463586c7e58550c01f50d48d54cb586c389a4e75264e7f692ced9229fd46759ac698
- SSDEEP 12288:pfop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/m:pANDGDn7q6dZhsCuarQSj/
- TLSH T1B7452305964854C6FC7ACE341614C421522479EDB725B7A7A181FBD22E348E0EEF1BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 0908f238c4c13378cddb1ca5aa1f1a6721c464521dc3f95391b86f9d25373180
- MD5 c9bcb4a70a87b29b9f815528bfca3a0c
- SHA1 d06a80ead3c364072ce0b81e763661fa800287cc
- SHA512 96cd08dd14f1552031b548860b6818cf8b57ef01cdc83b399df6eefa86a288b5ee639ed86755a72feff844ca42f1d39239fb63261755e1385f72e22a04b17c3c
- SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCCNDGDn7q6dZhsCuarQSj/:1RZwQCyiHiQEaiPnMXdc3L6CuQQSz
- TLSH T14D85BF1E62DC42A5E0BAD278CDA74407E6B278165731A7CF0291C27D1F27DF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 87a7ec8bd5ddefc28fc483858c9ca366bc4955298d2341fda590686b99724ba5
- MD5 26202db6420a15d450db2e5ebb22d8a1
- SHA1 2fac6ee5388cc9fa41e25d219f980a4d01d3ec0c
- SHA512 5a4d1d09dee9b6fd93da2782b0757b7a1afbecdbb1cb18803fbe5d69785f82d0ea320cba702d5ec121bdd72576f41f22a4b1418b4f12732058c177b389b9bad9
- SSDEEP 12288:KbxA1U7KPop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/K:KbxA1UGwNDGDn7q6dZhsCuarQSj/
- TLSH T11F55011E669C24E5F576DA3D89918002D330BC6A6325A3EF11C1C3BA0F3ADE49D75F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4af97dd070336a4984c3d122defe3f05449e02eea772a4bc15da267b29d19577
- MD5 6311e1135dc04e667c5f6efbd7e59420
- SHA1 641751021699a6c3f7ea7d9fcd1aa5746db0545c
- SHA512 4d9cfbb01fd2c078f3114852479ccfe1f72568877b986940c40c407c9380080a1847bc8e16869280840b638d085c56d61e3ce2825d1ddaafb5aaeaeba91952e4
- SSDEEP 24576:sjsmP0yHaqrVqHra44KDzMsrnNNDGDn7q6dZhsCuarQSj/:sjRP0yHfVqzlAsrnNdc3L6CuQQSz
- TLSH T15F45AF2EF2B910E9D8AAD136454107B5AB71782D1F209BC70170C635AF0AEE89F35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 8d9301029c445f2f84d0d3fcaded676aebb99bbb90c8cd0fe80b0945fcd51cc3
- MD5 1f90fef92b4f17edd8ebd19098176917
- SHA1 3693e50c5c70870b837f181423380d01cb11f107
- SHA512 7c7e9155b54d6e7882c197276ffd9a0cbb35e33643978784639145738798388793e564cb3b14e6a816498c5d9b95734e424d047b315d6b8d1390ffd642fb07bf
- SSDEEP 12288:rhop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/Z:raNDGDn7q6dZhsCuarQSj/
- TLSH T18E452309994450CAFD77CE781604C81192207DEAB12977A751D2FBA21F388F49FF1AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 b52084c098ff401f69863bf9091dfc19e5c89aca55209f705b669b6021c64523
- MD5 cf376818ce573a7752fa3a48b1439631
- SHA1 9e6c2920f59cced683d5557d2530c62e4d9e1b2f
- SHA512 d1c4318d9319ed1565401776377d3cc57daba2cb3278a17711fcd19bb5f7fe0ab3fc1cde6f05e1919b337567eaf2998a0a322d5635d19c62b9584b1c8732422e
- SSDEEP 12288:4ObfA4LWO+vAYFTDop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/k:VbLBUT0NDGDn7q6dZhsCuarQSj/
- TLSH T18475F145E79400F9ED7BC13CC9628916E271B89D1364E7DF03A88B661F236E14E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 ff926d8b2ed47880ce6ced9e05c58f7ad73950ee340652d0f273a0fc213de1d9
- MD5 263f5575764a1ab20825d3026110b566
- SHA1 b61be4b2d4a3c1c4d935233ad14a8f926e4bd189
- SHA512 27e9d9961646a44b2039388e1cf73b2843b42b953c18af8ae73bf045b31d8d7d5000a7c876fb7bf0b27a47bd4b53cfb7786e8d6d531aad9aba5e7e0582a1f193
- SSDEEP 12288:X70Vm9IYNvUyBpKop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/n:gpYNHhNDGDn7q6dZhsCuarQSj/
- TLSH T1B865F11E56AC18E5E53BD17D8A828505F27278A61311A3DF01F0C3BA1F27DE8BD3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 850fd8c4af8525562260dcd2351062328b7d260a771618c5de5ccffa36950f1e
- MD5 2e453b8dd4f7fcd73d0d9d5738f4d148
- SHA1 c1ee36da4a36707aca91c81da1a44e6563565a89
- SHA512 669c2f9f7ea4d600658aba02eba159ce5636a07767e4c3fca780132d7ff1fc844cbdcb4a3c4dc20ab004a24dacf72ed9b22943da8399d6c095bcb2f064011e0f
- SSDEEP 24576:hnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKl:hnXoJJYH84VVS6AmEOJas+cHBjSSKHP1
- TLSH T1A265BF5EA2BC04E8D5BBD17DC5824506F5B178661331C6CF0261C2BA3F27AF5AE35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 e57babbe16f8caa3fd536c6ccdc44992e42b5848aa52e8276636a0f5c6ac6613
- MD5 8703b42fb0ba08b6fe71d2ca07276e88
- SHA1 85fc705bb90597a052c586b0c1d68975fb32936c
- SHA512 32cabd9f1274b07be40b4ca080ca8067d7e492630d9b3f50fa15b7d17bf30331281a77cf7042be110bb74571c306e5ff73a3332ca70724b07a3824294c1e17c4
- SSDEEP 24576:nv7Xbxd9Tuycf8M/TYlSuxrr2PCDNDGDn7q6dZhsCuarQSj/:nDLL9TuJ0M/TYj2P6dc3L6CuQQSz
- TLSH T10A858D1EA2EC42D4E47BDABD85B79046FAB2B855173091CF0291856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 acf9fdc75bc4b3bfe008005beb2c698803476d96dc022043fe41495ce8945f92
- MD5 cfdfd6fc6f00f9deab62575b444cc36f
- SHA1 69eec659f83ab477178521c51db0440ed70194cf
- SHA512 c2c062b2c982ce7407a84e0ce0cffd08a315c44ecfb665f708f111ffe2a223b20291365d9520fd13e5e33e27e2f3dd944c183c27043fc97f26437ca7b4443060
- SSDEEP 24576:XegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w0NDGDn7q6dZhsCuarQSj/:XngOJOmPOHz0dc3L6CuQQSz
- TLSH T1A155C02FA7BC15D5E03EC17D8A928816F6B0782613355ACF0190827E5F2BEF46E39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 cf0794ed04c8d344e0fcef4a941581272209cfd84003ea19fff1ce8d1c36889c
- MD5 cc83551bde0a958ca015dd99c508fdb0
- SHA1 28f8be9e9cc171e350bb5e8c32771d27c56be721
- SHA512 f2a41ef74c6555b25bf1d9cb64609f9025d0f849952e1569ccb7a429198efd2e8d477087e813e84307c200d6bdf11e49b2d46fc17523e013f8751ce8d55cdd3a
- SSDEEP 24576:jLJnJiTk3R3waE4JrO6NDGDn7q6dZhsCuarQSj/:jLJnJK8R304lddc3L6CuQQSz
- TLSH T13475E12CD2A810E8E4B7C2B4825A1A56FF31347D3B216ACB15B4D5313F11FE0AA79F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a2cff747250fd83ba300121217543f45ca97d93f9a41d4b390ac3c770bab7008
- MD5 5fe66cbb4578affc6a04c79bfd67294a
- SHA1 5deade16c2fe248f02b9f80c15f62e688d7298cc
- SHA512 9ede40aa8d0321402c5c09ee43fe463ce6548e7288afd8b242289303579104085ffc020fb0f64a547773cc8b61615c8601d33591732614a1cf658ea7318b7d91
- SSDEEP 49152:89mqCzDScAZmlvTcFg8Ph62dc3L6CuQQSz:+B2+CCSz
- TLSH T120955D05F7EA5298F8B3CAF1C96294159B327C509734F7EF0A80CA6A1E32BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 c1df7e46c708359125e4967e4bdae6f58571f9d2aeb469d160943aed3dde4c48
- MD5 16f3cc04047f739ac9975fafcc30d1a4
- SHA1 f57442b7917c62ca9fe132adaa01e505e08ddf43
- SHA512 960ae4f197405fa50159e4ef291f7b622ec15b03665c7a99b2f99bf8a80564a54a119df3ad1c3c21c0c2bb94cdf4c4a8b746b8b17b15f6ce07823d770a5fc7db
- SSDEEP 24576:+lYJeXm5jUuEkNDGDn7q6dZhsCuarQSj/:+lYJeXmRUuEkdc3L6CuQQSz
- TLSH T18C55124D6A9C30E5F53AC9799A518800E330B4BA631167FF41E0D7BA4F359E06E39F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 195963b5777fcb9f43a0ac23f7ab55c9207149f731c8b6911e27b9240eab45b4
- MD5 f44f01e39b172767147afe3ad943a7e3
- SHA1 5ce57207882457e7d595197dcd09e49f6524a60e
- SHA512 6b37aa917e5fed53309b25fbc81d8626724eb3fa647e9578ce8e1d34140e990de77ba12ec3c6f6079c050594613f45869ac001ee7ec0089498aa617ad1ae77f8
- SSDEEP 12288:Qmu6ky0op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/Z:Q7tytNDGDn7q6dZhsCuarQSj/
- TLSH T117551208669460D8F9768A389A628050DB30BC75AB2463EF51D1F77F2F346E0AD70F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 8dc17350c6245f708b1a5caeb1acc49965ced305f0f316d6567607bc0f43cc4a
- MD5 58df9fb23a5de2b5b9a827cb664eaf37
- SHA1 a0735e30c62bfddb1eef55bbc5fc2449fc093ca8
- SHA512 352c1937d2ab411ce644abde23ddcd733005f16c8e3a1287a3ad02d09a2a48a2247e7a420f3b024c07642694ae41c7b336dce606274f8f441b392118e7ef77cc
- SSDEEP 12288:aPDop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/f:20NDGDn7q6dZhsCuarQSj/
- TLSH T1F945220D595460CAFC36CE7816148811923079BAB12977BB51D1FBB25F384E0AEF1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e61ea84c7f2711b5c06d4097a026cb5dbec7f95d505233f55525698a68ce4890
- MD5 1b91f8d220df740b2c65bc82b99de9e4
- SHA1 4cb7911a055ec287c486bf04ac216eb27f8d7800
- SHA512 d18145d1b0468a03f2f568475b1b7f836bcbd80cdcff17a1807e85f690fbb9f23b408d11055fed6540710ef5a4822239828b9bbe82c48632f78ce9d55207c872
- SSDEEP 24576:WC+TyQIu93VAumZr7jmPNDGDn7q6dZhsCuarQSj/:W/TfIq+YPdc3L6CuQQSz
- TLSH T152559D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 6d7ab5d5a3781d4809b2d664a279d5e87ef53dd45b55217ed1027ac0cad21f23
- MD5 4ed28580d8b2812f4911f718d5e55fee
- SHA1 2f2e3542b5dde973205bfe17f457fb83dace309a
- SHA512 27829722f9376f95b38fa796ddd141be547b17cfc277f37dbeade8acf8b92c86f47c02c96e07a5f30bfa7333b4603773e9e1283c5cada57dbc233382f4b34c49
- SSDEEP 12288:zcyrWOstaa3kcsXop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/n:yLQikZYNDGDn7q6dZhsCuarQSj/
- TLSH T1E765F00EB6AA10D5E4A7C23C88458112F6737475571263EF42E0C7BA0F775E9BE38B92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 3ca0f4dab183f7bedc4ee6fcd556550277390b393d7e4b0de343dc7770dc22cf
- MD5 fb4caeaf3146ca178f98951334cbc5a5
- SHA1 d2432117308d01052f67d2cc4173fe7339a38065
- SHA512 7b11e7ba5d14aec1ee826ba23b4b100c57560e2d8bd832accf6de105884640561be25df648b9d7c09915e3dd19fb12b923920f2536ac742513b0ff9d54da9891
- SSDEEP 49152:+pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPtdc3L6CuQR:rpC7b4+80GTke2+CCSz
- TLSH T1B1A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5170e3cc7e9da11944ca81d5789bc877c3a01ce0597a83fd55273609d93802b6
- MD5 ceabd078b90748a056b1d6f9d778bc05
- SHA1 9e667124d9f7e3820a2be0fbd6440ba384ac4a4b
- SHA512 40d1846c3c25dd0e6e2fd9a9ba21f2fc0e84b5dc94a7a829aa0cab77249de82f20ef29af457b481ae6d0ce5a479235d735e860f09d5ef1ce64ac7c4e643a606e
- SSDEEP 24576:OSAwJPE1IDAo+4Kt+l4413JUQFNDGDn7q6dZhsCuarQSj/:OqPCIo4Kol4vQFdc3L6CuQQSz
- TLSH T15C55BF1AA7F956E4E17ACBB49663C501FB727823133163CF4290827E0F169E89E79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 df564d046d5d2b32d791452924371bac42a4ca7a92d10adae991d7835e88609c
- MD5 db10562dc3b399f329c0fabc25c19160
- SHA1 9191241bd157f63afc2deb8af483350d6dae7935
- SHA512 3003377327d0c34bdb51e9b886495ed898a15c9e8263403e98f7be5e5dc179a96c0868edbc2b5129c1f7881b535684a7896ff3802e128a274c6596bb18a66f87
- SSDEEP 24576:dyLXPLcw94t1NDGDn7q6dZhsCuarQSj/:dy7PoXt1dc3L6CuQQSz
- TLSH T1F775E02ED66C04E5E47AC27CD6A38906F67138AD033166CB15E0D17A1F2BEF4A939F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 09546ab611dc72957837856b19fbc47ba00aa791a176d2bc7787574554575036
- MD5 78ba2e704669647dd88f8f06c3ce3dff
- SHA1 0205d0a498f9dbf74ce93d8f72a128ea9cf822c5
- SHA512 0589cd72e33d8c69f838ca7f75b4c8c3b598e0e7e4dc56f31aeca5580a658838712a50c95e68ee8232e2988f7fcdfa1e5368289e99f6191b66e7e29e96f1b22d
- SSDEEP 12288:89lyvj3IkxjbBznop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/o:8Wv8qjpoNDGDn7q6dZhsCuarQSj/
- TLSH T1B565120E569420C9F47ACA349621C0258170BCB623796BFF71C4EAB70F349D0DA7AF66
- MD5 SHA1 SHA512 SSDEEP TLSH